‘Convincing’ scam circulates IU email accounts

Phishers are targeting IU students, staff and faculty in what University Information Security officials called a “convincing-looking” email scam.

The message, which uses the IU logo and correctly cites the name of University Information Technology Services, prompts recipients to follow a link to a form within Google Drive and provide passphrase information for University-related accounts, according to a blog post published Monday by University Information Security Officer Andrew Korty.

Failure to provide a University passphrase, the scam email reads, “will violate the UITS Email Policies. This will render your account inactive.”

Scams requesting personal information — known as phishing scams — occur frequently, said Scott Wilson of the University Information Security Office.

“The only thing that distinguishes this one is they get a lot of details right,” he said.

UITS contact information for both IU-Bloomington and IU-Purdue University Indianapolis are also correctly cited in the signature of the scam email.

“The more authentic it looks, the more likely it is that someone will take the bait,” Wilson said.

Wilson said it is against University policy for an IU affiliate to ask for another student or staff member’s passphrase. It is also against IU policy to give out one’s own personal information or use someone else’s passphrase, he said.

Although the policy only dictates passphrase use for University-related accounts, Wilson said the advice should be applied to all personal information online.

“Nobody should ever be you online,” he said.

Wilson said those receiving emails they suspect to be phishing scams should refrain from clicking links or replying to the message and instead delete it.

A user will rarely be alerted of urgent news, such as the compromise of personal information to an account, via email, Wilson said. If a suspicious email looks like it came from a familiar party, validate its authenticity over the phone or in person, he said.

“If it looks fishy, treat it like it is,” he said.

For more information about IU’s information technology-related policies, visit policies.iu.edu.

— Kirsten Clark